Linux kernel (drivers/vfio): A blocked migration-state transition makes the vfio state machine spin forever while

CVSS 6.2CVE-2026-64474Kernel, userspace & hypervisorcurated

Impact

A blocked migration-state transition makes the vfio state machine spin forever while holding the driver's state mutex. The calling thread never returns, a CPU is pinned in kernel mode, and on a node booted with softlockup_panic the box panics outright - one ioctl from one tenant is a noisy-neighbour outage for everyone else on the node.

Who can reach it

A tenant holding /dev/vfio/* for a migration-capable device issues VFIO_DEVICE_FEATURE with MIG_DEVICE_STATE requesting the blocked STOP_COPY to PRE_COPY (or PRE_COPY_P2P) transition. Conditional on a vfio variant driver that advertises precopy - mlx5 VFs, Intel Xe and QAT VFs and similar - being bound to the tenant's device. No host privilege needed.

What to do

Update to a stable kernel carrying commits 8e872c07 / ed7d5599. Interim: bind tenant devices to plain vfio-pci rather than a migration-capable variant driver where you do not need live migration, and do not boot tenant nodes with softlockup_panic.

References

https://git.kernel.org/stable/c/8e872c07e40d51a66dee7b280a23a460a2e1e3fa https://git.kernel.org/stable/c/ed7d5599e6c398da74845767cd1e6a8370a160fc https://nvd.nist.gov/vuln/detail/CVE-2026-64474

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.